skip singing apks which ar not validating with signatures from metadata

fdroidserver/publish.py

@@ -171,6 +171,7 @@ def main():
         else:
 
             # It's a 'normal' app, i.e. we sign and publish it...
+            skipsigning = False
 
             # First we handle signatures for this app from local metadata
             signingfiles = common.metadata_find_developer_signing_files(appid, vercode)
@@ -194,6 +195,7 @@ def main():
                 else:
                     os.remove(devsignedtmp)
                     logging.error('...verification failed - skipping: %s', devsigned)
+                    skipsigning = True
 
             # Now we sign with the F-Droid key.
 
@@ -203,6 +205,7 @@ def main():
             # If a collision does occur later, we're going to have to
             # come up with a new alogrithm, AND rename all existing keys
             # in the keystore!
+            if not skipsigning:
                 if appid in config['keyaliases']:
                     # For this particular app, the key alias is overridden...
                     keyalias = config['keyaliases'][appid]